DEP0190: spawnServer passes args array with shell:true, triggering Node v26 deprecation warning

[DylanPiercey]

Bug

Running npm run preview (i.e. marko-run preview) logs the following deprecation warning on Node.js v26:

(node:24456) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.

Root cause

In packages/run/src/adapter/index.ts (distributed as dist/adapter/index.js), the spawnServer function calls:

cp.spawn(cmd, args, {
  shell: true,
  ...
});

Node.js v26 introduced DEP0190 which warns when a separate args array is passed alongside shell: true, because the args are concatenated (not escaped) before being handed to the shell, which can be a security risk.

Fix

Either:

1. Merge cmd + args into a single string when using shell: true:

   cp.spawn([cmd, ...args].join(" "), [], { shell: true, ... });

2. Drop shell: true if it is only needed for Windows .cmd/.bat resolution, and use { shell: process.platform === "win32" } — but then also merge args into the command string on that path.

Environment

• @marko/run: 0.11.0
• Node.js: v26.2.0
• OS: macOS Darwin 25.5.0